> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-gcp-terraform.md).

# Deploy the Assembler in GCP (Terraform)

Each assembler you created must be deployed via a virtual machine, and then you can add your technology as a security device in Workbench to complete the full integration. For more information about the Expel Assembler or how it works, see the [About the Expel Assembler](/connect-your-technology/expel-assembler/about-the-expel-assembler.md) guide.

{% hint style="info" %}
Terraform lets you define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share. These instructions assume you have working knowledge of Terraform; if you need additional help or context, refer to the [Terraform Documentation](https://developer.hashicorp.com/terraform).
{% endhint %}

## Prerequisites

* You must have completed all of the steps in [Add a New Assembler](/connect-your-technology/expel-assembler/add-a-new-assembler.md) for each assembler you wish to deploy.
* You must have already created a project in the Google Cloud Console and set up billing.
* You must have[ Terraform installed](https://developer.hashicorp.com/terraform/tutorials/gcp-get-started/install-cli?in=terraform%2Fgcp-get-started).
* You must have the [gcloud CLI installed](https://cloud.google.com/sdk/docs/install).

## Step 1: Download the Ignition File

The ignition file enables the virtual machine to read a configuration file, and to provision the Fedora CoreOS system based on the contents of that file. You will use this file when you configure the virtual machine in GCP.

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Assemblers**.
3. Find the assembler you created, leave the file format as JSON, and select **Download the CoreOS Ignition File**. This action will download a JSON file that you will need in the next section.

{% hint style="info" %}
You may choose a different file format if you like, but the JSON format is recommended for this type of assembler.
{% endhint %}

<figure><img src="/files/Eafkj0BJOEqa4x4PfyJF" alt="Select the JSON format in the right menu, and then select the download link."><figcaption></figcaption></figure>

4. Move your ignition file to a remote, secure location such as [Google's Cloud Storage](https://cloud.google.com/storage?hl=en). The contents of the ignition file will be stored in plaintext (unencrypted) wherever your Terraform state files are located.

{% hint style="danger" %}

1. **Do not store your ignition file in a git repository.** The file contains sensitive information and git is not a suitable place for this type of data.
2. **Be sure to lock down access to the storage location.** Only people who need access to the ignition file (and to the Terraform state files if using [Terraform Remote State](https://developer.hashicorp.com/terraform/language/state/remote)) should have access to the storage location.
   {% endhint %}

5) Repeat this process for any additional assemblers.

{% hint style="warning" %}
You must keep track of which files came from which assembler, because each assembler has its own unique ignition file.
{% endhint %}

## Step 2: Set Up the Terraform Config File for GCP

Terraform will use the Google Cloud provider to configure your GCP infrastructure.&#x20;

1. If you are running Terraform locally, first use the following command to authenticate with GCP.

```
gcloud auth application-default login
```

2. Create a [Terraform config file](#user-content-fn-1)[^1] if you do not have one, and make sure the file has the following configuration.
   * The google `provider` block is used to configure your GCP authentication credentials.
   * The `project` is your project ID.
   * The `region` is the default location for your created resources.
   * Optional: If you have zonal resources, add `zone` to this config file as well (a zone will be set automatically if you do not specify one).

```
provider "google" {
  project = "YourProject"
  region  = "us-east1"
}
```

## Step 3: Set the Path and Bucket Name

Use the [google\_storage\_bucket\_object\_content](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/storage_bucket_object_content) data source and set the path and bucket name to point to where you stored your ignition file.&#x20;

{% hint style="info" %}
If you are deploying more than one assembler, this step will need to be repeated for each assembler.
{% endhint %}

```
data "google_storage_bucket_object_content" "ignition_file" {
  name   = "path/to/ignition/file.json"
  bucket = var.ignition_file_bucket 
}
```

## Step 4: Configure and Spin Up the Virtual Machine

Use the [google\_compute\_instance](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance) resource to configure your virtual machine with the minimum requirements.&#x20;

{% hint style="info" %}
If you are deploying more than one assembler, this step will need to be repeated for each assembler.
{% endhint %}

* `machine_type` is “n2-standard-2”, which has the minimum CPU and RAM requirements for an assembler.
* `image` is “fedora-coreos-stable”, which is the image family name provided by Google that is needed for an assembler.
* `size` is "20", which indicates the 20GB minimum disk size required for an assembler.

```
resource "google_compute_instance" "assembler" {
  name         = var.assembler_name
  machine_type = "n2-standard-2"
  zone         = var.zone
  network_interface {
    network = var.network_id
  }
  boot_disk {
    initialize_params {
      image  = "fedora-coreos-stable"
      size   = 20
    }
  }
  metadata_startup_script = data.google_storage_bucket_object_content.ignition_file.content
}
```

## Step 5: Verify a “Connected” Status in Workbench

{% hint style="info" %}
It can take 10 to 15 minutes for the assembler’s status to update in Workbench.
{% endhint %}

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Assemblers** (or, refresh the page if you never logged out).
3. Find your newly created assembler(s) and verify that the status has changed from “Not Yet Connected” to “Connected.”&#x20;
   * If your assembler(s) still do not show as connected after waiting at least 15 minutes and refreshing the page, see the [Troubleshooting](#troubleshooting) section for help.

## Step 6: Connect Your Technology

You can now set up your vendor technology in Workbench.

<button type="button" class="button primary" data-action="search" data-icon="magnifying-glass">Search for your setup guide…</button>

## Troubleshooting

If your assembler is still not showing as “Connected” after 15 minutes:

* Make sure your chosen connection has the proper [firewall configurations](/connect-your-technology/expel-assembler/add-a-new-assembler.md#step-2-update-your-firewall-configuration) to allow our outbound ports.
* Make sure your config file includes the correct project name and region ([Step 2](#step-2-set-up-the-terraform-config-file-for-gcp)).
* Make sure your ignition file is at the path specified, and that you are referencing the correct ignition file for your assembler ([Step 3](#step-3-set-the-path-and-bucket-name)).
* Make sure your chosen machine’s size meets the required minimums (2 virtual CPUs, 8 GB RAM, and 20 GB disk space).

If all firewall, config file, and resource definitions settings are correct and you are still unable to connect the assembler, [contact Support](/support/how-to-reach-us.md) for help.

## Reference

### Full Code Examples

<details>

<summary>terraform.tf (config file)</summary>

```
provider "google" {
  project = "myproject"
  region  = "us-east1"
}
```

</details>

<details>

<summary>assembler.tf (resource definitions)</summary>

```
data "google_storage_bucket_object_content" "ignition_file" {
  name   = "path/to/ignition/file.json"
  bucket = var.ignition_file_bucket 
}

resource "google_compute_instance" "assembler" {
  name         = var.assembler_name
  machine_type = "n2-standard-2"
  zone         = var.zone
  network_interface {
    network = var.network_id
  }
  boot_disk {
    initialize_params {
      image  = "fedora-coreos-stable"
      size   = 20
    }
  }
  metadata_startup_script = data.google_storage_bucket_object_content.ignition_file.content
}
```

</details>

[^1]: A file name might be terraform.tf.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/connect-your-technology/expel-assembler/deploy-the-virtual-machine/deploy-the-assembler-in-gcp-terraform.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.